RE: WebLua

[Tom Wrensch <twrensch@...>]

On Fri, 12 Jul 2002, John Passaniti wrote:

> > N.B. I've currently disabled the "lua" button
>> ...snip..
> 
> Add a block of code that executes prior to the user's code.  That code
> would redefine all functions deemed dangerous (all the file-related
> functions) to nil.  

Or better yet, replace them with functions that can't write to or read
from a file, but still exist. For example write() could be redone as:

    function write(file,value)
        if file then
            %write(value)
        else
            %write(file)
        end
    end

Which would redirect all writes to standard out. openfile() could be
rewritten as:

    function openfile()
        return _STDOUT
    end


You'd have to be careful exactly how you did this, but I'm sure you could
protect your file system this way.

  - Tom